CVE-2022-23482: 
xrdp vulnerability analysis and mitigation

xrdp, an open-source project that provides graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP), was found to contain an Out-of-Bounds Read vulnerability in versions prior to 0.9.21. The vulnerability was specifically identified in the xrdp_sec_process_mcs_data_CS_CORE() function (GHSA Advisory).

The vulnerability is tracked as CVE-2022-23482 and affects xrdp versions <= 0.9.20. The issue stems from incorrect handling of validation of client-supplied data, which could lead to out-of-bounds reads. The vulnerability has been assigned a CVSS v3.1 base score indicating low severity (GHSA Advisory).

If exploited, this vulnerability could potentially allow an attacker to crash the program or extract sensitive information from the affected system (Ubuntu Notice).

The vulnerability requires network access and can be exploited with low attack complexity, requiring no privileges or user interaction (GHSA Advisory).

The vulnerability has been fixed in xrdp version 0.9.21. Users are recommended to upgrade to this version or apply the appropriate security patches. For Ubuntu users, specific package versions have been released: Ubuntu 22.04 (0.9.17-2ubuntu2+esm1), Ubuntu 20.04 (0.9.12-1ubuntu0.1+esm1), and Ubuntu 18.04 (0.9.5-2ubuntu0.1~esm2) (Ubuntu Notice).